It can be difficult for a network administrator to discern what activity, such as protocols, programs, and/or services, are running on systems within a network. There may be a certain set of expected protocols, programs, and/or services being used by major business functions on the network. However, there may also be other protocols, programs, and/or services such as instant messaging programs, games, etc., that individual users may have installed that could be interfering with operation of the network. Furthermore, malicious programs such as viruses and worms may have been installed on systems without users' or administrators' knowledge. Such activity can be difficult to identify and track.